Except it isn't... Because the app can just show a UI that looks like a browser window, and there's no way for the user to know.
It could be faked 95% accurately, but that's moot, because like I said, the user hasn't necessarily learned what "trusted UI" is in the first place.
Looks like it was a real Facebook login webview.
The difference may of course be subtle, but even obviously fake logins can work on the untrained eye.